#!/bin/bash
# Robust Registry Authentication Script
# Following Mintel CI/CD Hardening Standards

# 1. Discovery
TOKENS="${NPM_TOKEN} ${GITEA_PAT} ${MINTEL_PRIVATE_TOKEN}"

VALID_TOKEN=""

echo "🔍 Starting functional registry discovery..."

for T in $TOKENS; do
    [ -z "$T" ] && continue
    
    T_START="${T:0:4}"
    T_END="${T: -4}"
    echo "Testing token starting with '$T_START...' and ending with '...$T_END'"
    
    # Use Gitea API to verify token
    # We use -k (insecure) if needed, but infra.mintel.me should have valid certs
    STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $T" "https://git.infra.mintel.me/api/v1/user" || echo "500")
    
    if [ "$STATUS" == "200" ]; then
        VALID_TOKEN="$T"
        echo "✅ Token verified via API"
        break
    else
        echo "❌ Token rejected by API (Status: $STATUS)"
    fi
done

# Fallback: If API verification failed, try to use NPM_TOKEN if provided
if [ -z "$VALID_TOKEN" ] && [ -n "$NPM_TOKEN" ]; then
    echo "⚠️ API verification failed, falling back to provided NPM_TOKEN"
    VALID_TOKEN="$NPM_TOKEN"
fi

if [ -z "$VALID_TOKEN" ]; then
    echo "❌ CRITICAL: No valid registry token found in environment."
    exit 1
fi

# 2. Hardened .npmrc Generation
# Trailing slashes are CRITICAL for pnpm registry matching
cat << EOF > .npmrc
@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm/
//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
//git.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
//registry.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
//registry.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
EOF

echo "✅ .npmrc hardened and generated."